At least $21.8 billion in illicit or high-risk crypto has flowed through crosschain swaps, up from $7 billion in 2023, according to estimates by UK-based blockchain analytics firm Elliptic. Elliptic attributes 12% of those movements to North Korea.
Crosschain swaps were once a niche activity reserved for advanced traders and decentralized finance (DeFi) users, but they’ve evolved into a core component of money laundering. Illicit actors no longer simply send crypto through mixers or dump tokens on a single decentralized exchange (DEX). Nowadays, the funds move around multiple blockchains to frustrate investigators and evade detection.
This swift 211% increase, from $7 billion to $21.8 billion, reflects the growing use of blockchain bridges, DEXs and coin swap services, as well as the expanding number of blockchains.
“When you look back, let’s say a decade ago, the primary cryptocurrencies and blockchains out there were Bitcoin and Ethereum and a few others,” Arda Akaturna, Elliptic’s APAC lead crypto threat researcher, told Cointelegraph.
“It’s an increasingly multichain ecosystem… that just widens the available assets and the available obfuscation channels open to criminals.”
Bridges are crosschain laundering highways
A single bridge transaction might reflect ordinary user behavior, but patterns of structured or multi-hop activity are red flags for coordinated efforts to break the onchain trail, Elliptic said in its 2025 crosschain crime report published on Wednesday.
Structured chain-hopping involves splitting funds and distributing them simultaneously across several blockchains. Multi-hop chain-hopping is the act of moving assets from one chain to another repeatedly. Both techniques are inefficient by design, and come with high fees in order to confuse investigators.
These methods are increasingly common in high-stakes laundering operations. In one early 2025 case, hackers suspected to be linked to North Korea stole $75 million from an unnamed exchange and bridged the funds in sequence from Bitcoin to Ethereum, then to Arbitrum, Base and finally Tron — employing both structured and multi-hop tactics.
Related: From Sony to Bybit: How Lazarus Group became crypto’s supervillain
These patterns are no longer limited to state actors or large-scale thefts. In a separate case involving a $200,000 fraud in the UK, the now-convicted culprit split funds across 90 different assets on multiple chains to fund online gambling.
Akaturna explained:
“This isn’t just high-level activity reserved for major hackers. You’ve got smaller-scale criminals using chain hopping to launder funds — people funding gambling habits or petty frauds. That’s how mainstream this tactic has become.”
Elliptic estimates that around a third of blockchain investigations now involve tracing flows across at least three different networks.
Crosschain laundering starts in DeFi
DEXs are often viewed as transparent and traceable as they operate on blockchains. However, they’re increasingly being used as entry points in the crypto laundering cycle, especially when low-liquidity tokens are involved.
DEXs are platforms where such assets can be swapped for more widely accepted tokens like USDt (USDT) or Ether (ETH) without relying on centralized platforms that may enforce Know Your Customer (KYC) rules.
A case study by Elliptic in its 2025 crosschain crime report analyzed the May 2025 exploit on Cetus — a major liquidity provider on the Sui blockchain — that enabled attackers to drain over $200 million in tokens. The attacker initially used a DEX to swap USDT to USDC, which Elliptic suspects was possibly to take advantage of lower bridging costs.
Related: Twice lucky? Cetus’ recovery plan on Sui mirrors a Solana blueprint
These stablecoins were then bridged to Ethereum, where a DEX aggregator was used again to convert the USDC into ETH. Centralized stablecoins like USDt and USDC have functions that allow their issuers to freeze funds. Ether, which is the native asset of the Ethereum blockchain, does not inherently have that functionality.
Criminals also exploit the open design of DEX aggregators and automated market makers (AMMs) to route transactions in ways that reduce slippage and avoid detection. For instance, laundering flows often pass through multiple obscure trading pairs before settling in a liquid token. In many cases, these swaps are performed in small batches or via smart contracts to avoid triggering Anti-Money Laundering (AML) alarms.
Though DEXs are not inherently crosschain, the distinction is becoming less clear in newer services as they also offer native cross-asset swaps, Elliptic said.
Coin swap sites star in crosschain laundering
Coin swap services operate more like underground currency…
cointelegraph.com